SAMA Outsourcing & Cloud Rules

SAMA regulates outsourcing through dedicated rules for the institutions it supervises, complemented by its Cyber Security Framework and its guidance on cloud computing. The common thread is that a regulated institution stays fully responsible for anything it outsources. Before engaging a provider it must classify whether the arrangement is material, assess the provider's financial, operational and security risk, and for material arrangements notify SAMA or obtain its non-objection. The contract must give the institution and SAMA the right to audit the provider, define where data is stored and processed, restrict onward subcontracting, require incident reporting, and include an exit strategy so the service can be brought back or moved without disruption.

An AI agent on a bank's WhatsApp line, a voice agent in a finance company's call centre, or a model reading customer documents is an outsourcing arrangement in SAMA's terms as soon as an external vendor or a cloud model provider is involved. That has design consequences: customer data may need to stay in Saudi Arabia, the model provider becomes a sub-outsourcer that must be disclosed, call recordings and transcripts fall under retention and access rules, and the institution must be able to switch the AI off or replace it. Many self-serve AI tools cannot offer audit rights, regional hosting or an exit plan, which is why financial institutions usually need an implementation partner instead.

Nano AI delivers finance-sector work as an implementation engagement with the documentation SAMA-regulated clients need: a data flow and hosting-region map, a named list of sub-processors, monitoring and evaluation reports, and an exit plan that hands over prompts, configurations and data. If you are a bank, insurer or fintech comparing vendors, ask whether they will sign audit-rights clauses, which components can be hosted in-Kingdom, and what happens to your data and configuration if you terminate; those answers show whether the vendor has worked under SAMA rules before.